From 5484dad7f6122a4d4dbc28e867a8c71d22ba2297 Mon Sep 17 00:00:00 2001
From: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Date: Sun, 21 Jan 2007 09:55:28 +0000
Subject: Fix crash when pred_order greater s->blocksize >> rice_order. Fixes
 http://sam.zoy.org/zzuf/lol-mplayer.flac

Originally committed as revision 7595 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/flac.c | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'libavcodec/flac.c')

diff --git a/libavcodec/flac.c b/libavcodec/flac.c
index e704d990e3..1016ed47f6 100644
--- a/libavcodec/flac.c
+++ b/libavcodec/flac.c
@@ -225,6 +225,10 @@ static int decode_residuals(FLACContext *s, int channel, int pred_order)
     rice_order = get_bits(&s->gb, 4);
 
     samples= s->blocksize >> rice_order;
+    if (pred_order > samples) {
+        av_log(s->avctx, AV_LOG_ERROR, "invalid predictor order: %i > %i\n", pred_order, samples);
+        return -1;
+    }
 
     sample=
     i= pred_order;
-- 
cgit v1.2.3